Contextual trust assessment of electronic messages using large language models in computerized organizational networks

Abstract

A computer-implemented method comprising: receiving an electronic message at an endpoint device associated with an organization; analyzing the electronic message by a local agent executed on the endpoint device; classifying the electronic message into one of a plurality of trust levels by the local agent; generating, by the local agent, a real-time alert or action at the endpoint device based on the classification; transmitting, by the local agent, metadata associated with the electronic message and its classification to a centralized machine learning engine; and updating, by the centralized machine learning engine, one or more machine learning models based on aggregated metadata received from a plurality of endpoint devices, wherein the one or more updated machine learning models are used to improve subsequent classification of electronic messages at the endpoint devices.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 automatically receiving an electronic message at an endpoint device associated with an organization;   automatically analyzing the electronic message by a local agent executed on the endpoint device, based on: (i) data sensitivity associated with the content of the electronic message, (ii) communication behavior baselines of a sender and a recipient of the electronic message, (iii) job roles of the sender and the recipient, and an organizational hierarchy listing the job roles, and (iv) one or more enterprise security policies of the organization;   automatically classifying the electronic message into one of a plurality of trust levels by the local agent, wherein the trust levels comprise at least: (a) a trusted level permitting fulfillment of the message, (b) a suspicious level requiring human verification, and (c) a blocked level preventing fulfillment of the message unless explicitly approved;   automatically generating, by the local agent, a real-time alert or action at the endpoint device based on the classification, the alert or action comprising at least one of: (i) permitting the message to be viewed by the recipient, (ii) requiring additional verification before permitting the message to be viewed by the recipient, (iii) blocking the message from being reviewed by the recipient, or (iv) displaying, to the recipient, an indicator respective of the classification;   automatically transmitting, by the local agent, metadata associated with the electronic message and its classification to a centralized machine learning engine; and   automatically updating, by the centralized machine learning engine, one or more machine learning models based on aggregated metadata received from a plurality of endpoint devices, wherein the one or more updated machine learning models are used to improve subsequent classification of electronic messages at the endpoint devices.   
     
     
         2 . The method of  claim 1 , wherein the analyzing of the electronic message by the local agent comprises operating a Large Language Model (LLM). 
     
     
         3 . The method of  claim 2 , wherein the operating of the LLM comprises evaluating data sensitivity of the message content, by detecting at least one of: confidential terms, financial data, or personally identifiable information. 
     
     
         4 . The method of  claim 2 , wherein the operating of the LLM comprises evaluating communication behavior baselines for the sender and the recipient by comparing at least one or: historical patterns, typical linguistic characteristics, tone, or structure, against the electronic message. 
     
     
         5 . The method of  claim 2 , wherein the operating of the LLM comprises evaluating job roles of the sender and recipient respective of organizational hierarchy information, by querying a directory service of the organization. 
     
     
         6 . The method of  claim 2 , wherein the operating of the LLM comprises retrieving and evaluating enterprise security policies applicable to the sender and the recipient. 
     
     
         7 . The method of  claim 1 , further comprising automatically operating the local agent to normalize protocol-specific message content and metadata originating from a plurality of communication channels by extracting header fields, message bodies, attachments, and contextual signals into a standardized data structure configured for automated analysis. 
     
     
         8 . The method of  claim 1 , further comprising automatically operating the local agent to apply both rule-based filters and at least one lightweight machine learning classifier to the electronic message, to assign a priority label to the electronic message prior to said analyzing. 
     
     
         9 . The method of  claim 1 , wherein the centralized machine learning engine:
 automatically executes a vectorization pipeline that generates multi-dimensional embeddings of content, style, and recipient context of the electronic message, using a transformer-based large language model; and   automatically compares the generated multi-dimensional embeddings to a database of threat pattern vectors, to compute a similarity score indicative of potential impersonation and/or potential data exfiltration.   
     
     
         10 . The method of  claim 1 , wherein, responsive to classification of the electronic message to the suspicious or the blocked trust levels, the local agent or central server:
 automatically initiates an authentication workflow comprising at least one of: two-factor authentication, biometric verification, a challenge-response protocol, or escalation to a designated security officer; and   automatically records the authentication outcome as feedback for subsequent retraining of the one or more machine learning models.   
     
     
         11 . A computer program product comprising a non-transitory computer-readable storage medium having program code embodied therewith, the program code executable by at least one hardware processor to:
 automatically receive an electronic message at an endpoint device associated with an organization;   automatically analyze the electronic message by a local agent executed on the endpoint device, based on: (i) data sensitivity associated with the content of the electronic message, (ii) communication behavior baselines of a sender and a recipient of the electronic message, (iii) job roles of the sender and the recipient, and an organizational hierarchy listing the job roles, and (iv) one or more enterprise security policies of the organization;   automatically classify the electronic message into one of a plurality of trust levels by the local agent, wherein the trust levels comprise at least: (a) a trusted level permitting fulfillment of the message, (b) a suspicious level requiring human verification, and (c) a blocked level preventing fulfillment of the message unless explicitly approved;   automatically generate, by the local agent, a real-time alert or action at the endpoint device based on the classification, the alert or action comprising at least one of: (i) permitting the message to be viewed by the recipient, (ii) requiring additional verification before permitting the message to be viewed by the recipient, (iii) blocking the message from being reviewed by the recipient, or (iv) displaying, to the recipient, an indicator respective of the classification;   automatically transmit, by the local agent, metadata associated with the electronic message and its classification to a centralized machine learning engine; and   automatically update, by the centralized machine learning engine, one or more machine learning models based on aggregated metadata received from a plurality of endpoint devices, wherein the one or more updated machine learning models are used to improve subsequent classification of electronic messages at the endpoint devices.   
     
     
         12 . The computer program product of  claim 11 , wherein the analyzing of the electronic message by the local agent comprises operating a Large Language Model (LLM). 
     
     
         13 . The computer program product of  claim 12 , wherein the operating of the LLM comprises evaluating data sensitivity of the message content, by detecting at least one of: confidential terms, financial data, or personally identifiable information. 
     
     
         14 . The computer program product of  claim 12 , wherein the operating of the LLM comprises evaluating communication behavior baselines for the sender and the recipient by comparing at least one or: historical patterns, typical linguistic characteristics, tone, or structure, against the electronic message. 
     
     
         15 . The computer program product of  claim 12 , wherein the operating of the LLM comprises evaluating job roles of the sender and recipient respective of organizational hierarchy information, by querying a directory service of the organization. 
     
     
         16 . The computer program product of  claim 12 , wherein the operating of the LLM comprises retrieving and evaluating enterprise security policies applicable to the sender and the recipient. 
     
     
         17 . The computer program product of  claim 11 , wherein the program code is further executable to automatically operate the local agent to normalize protocol-specific message content and metadata originating from a plurality of communication channels by extracting header fields, message bodies, attachments, and contextual signals into a standardized data structure configured for automated analysis. 
     
     
         18 . The computer program product of  claim 11 , wherein the program code is further executable to automatically operate the local agent to apply both rule-based filters and at least one lightweight machine learning classifier to the electronic message, to assign a priority label to the electronic message prior to said analyzing. 
     
     
         19 . The computer program product of  claim 11 , wherein the centralized machine learning engine:
 automatically executes a vectorization pipeline that generates multi-dimensional embeddings of content, style, and recipient context of the electronic message, using a transformer-based large language model; and   automatically compares the generated multi-dimensional embeddings to a database of threat pattern vectors, to compute a similarity score indicative of potential impersonation and/or potential data exfiltration.   
     
     
         20 . The computer program product of  claim 11 , wherein, responsive to classification of the electronic message to the suspicious or the blocked trust levels, the local agent or central server:
 automatically initiates an authentication workflow comprising at least one of: two-factor authentication, biometric verification, a challenge-response protocol, or escalation to a designated security officer; and   automatically records the authentication outcome as feedback for subsequent retraining of the one or more machine learning models.